19ffefca0054a6fccff7721f57e711e881a3ecfde650a7258cf89b5f3c5e95af | Triage

Analysis

max time kernel
10s
max time network
116s
platform
windows10_x64
resource
win10v20201028
submitted
04-11-2020 18:16

Sharing

Report Analysis Logs

General

Target

spr.bat
Size

86B
MD5

d3061ed8a1faea8327150f4d3f523b70
SHA1

0b11c2073bddce442fcb72a459667173ca2cbb28
SHA256

3b48a7dab6a2ddd45687883da733189b3b6fe271a6d822a1f8ac56a52ee933fd
SHA512

4638f0b8b14005b1005c36d8d14721f3459d2529fae36a5a1d77cb4b4e2d3f7a2d778d92fd1cc5aa954bfc992233bd6a79b49c866fbd0b98948bfee6f93305cc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 640	984	cmd.exe	72
PID 984 wrote to memory of 640	984	cmd.exe	72

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\spr.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\system32\rundll32.exe
  rundll32.exe "\\SRV01QW\sp\b.dll",DllRegisterServer --append="carraro" --multiproc
  2⤵
  PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads